Drop make-tls-process.el in favor of gnutls.el

Closes #377

README.md

@@ -23,13 +23,9 @@ Complexity-wise, it is somewhere between rcirc (very minimal) and ERC
 
 ### Dependencies
 
-In order to securely connect to an IRC server using TLS, Circe requires the
-[GnuTLS](https://www.gnutls.org/) binary. On Debian-based
-GNU+Linux-distributions, you can install it likes this:
-
-```Shell
-apt install gnutls-bin
-```
+In order to securely connect to an IRC server using TLS, Circe
+requires an Emacs linked against the [GnuTLS](https://www.gnutls.org/)
+library.
 
 For displaying images, Circe requires
 [ImageMagick](https://www.imagemagick.org/script/index.php).
@@ -98,11 +94,6 @@ add something like the following:
 With this in your configuration, you can use `M-x circe RET Freenode
 RET` to connect to Freenode using these settings.
 
-_Please note:_ Circe uses the `openssl` or `gnutls-cli` command line
-programs to connect via TLS. These tools do not by default verify the
-server certificate. If you want to verify the server certificate,
-customize the `tls-connection-command` variable.
-
 ## Features
 
 - Sensible defaults

irc.el

@@ -42,7 +42,7 @@
 ;;; Code:
 
 (require 'cl-lib)
-(require 'make-tls-process)
+(require 'gnutls)
 
 (defvar irc-debug-log nil
   "Emit protocol debug info if this is non-nil.")
@@ -70,23 +70,36 @@ conn.disconnected conn -- A previously established connection was lost
 
 NNN conn sender args... -- A numeric reply from IRC was received
 COMMAND conn sender args... -- An IRC command message was received"
-  (let ((proc (funcall (if (plist-get keywords :tls)
-                           #'make-tls-process
-                         #'make-network-process)
-                       :name (or (plist-get keywords :name)
-                                 (plist-get keywords :host))
-                       :host (or (plist-get keywords :host)
-                                 (error "Must specify a :host to connect to"))
-                       :service (or (plist-get keywords :service)
-                                    (error "Must specify a :service to connect to"))
-                       :family (plist-get keywords :family)
-                       :coding 'no-conversion
-                       :nowait (featurep 'make-network-process '(:nowait t))
-                       :noquery t
-                       :filter #'irc--filter
-                       :sentinel #'irc--sentinel
-                       :plist keywords
-                       :keepalive t)))
+  (let* ((host (or (plist-get keywords :host)
+                   (error "Must specify a :host to connect to")))
+         (service (or (plist-get keywords :service)
+                      (error "Must specify a :service to connect to")))
+         (tls-parameters (when (plist-get keywords :tls)
+                           (when (not (gnutls-available-p))
+                             (error "gnutls support missing"))
+                           (cons 'gnutls-x509pki
+                                 (gnutls-boot-parameters
+                                  :type 'gnutls-x509pki
+                                  :hostname host
+                                  :verify-error t))))
+         (proc (make-network-process
+                :name host
+                :host host
+                :service service
+                :family (plist-get keywords :family)
+                :coding 'no-conversion
+                :nowait (featurep 'make-network-process '(:nowait t))
+                :noquery t
+                :tls-parameters tls-parameters
+                :filter #'irc--filter
+                :sentinel #'irc--sentinel
+                :plist keywords
+                :keepalive t)))
+    (when (and (plist-get keywords :tls)
+               (fboundp 'nsm-verify-connection))
+      (setq proc (nsm-verify-connection proc host service))
+      (when (not proc)
+        (error "nsm verification failed")))
     ;; When we used `make-network-process' without :nowait, the
     ;; sentinel is not called with the open event, so we do this
     ;; manually.

tests/test-irc.el

@@ -6,10 +6,16 @@
 ;;;;;;;;;;;;;;;;;;;;;;;
 ;;; Connection function
 
+(defvar default-tls-parameters
+  (cons 'gnutls-x509pki
+        (gnutls-boot-parameters
+         :type 'gnutls-x509pki
+         :hostname "irc.local"
+         :verify-error t)))
+
 (describe "The `irc-connect' function"
   :var (process-status)
   (before-each
-    (spy-on 'make-tls-process :and-return-value 'the-test-tls-process)
     (spy-on 'make-network-process :and-return-value 'the-test-process)
     (spy-on 'process-status :and-call-fake (lambda (proc) process-status))
     (spy-on 'irc--sentinel :and-return-value nil))
@@ -23,16 +29,23 @@
             :name "irc.local" :host "irc.local" :service 6667
             :family nil
             :coding 'no-conversion :nowait t :noquery t
+            :tls-parameters nil
             :filter #'irc--filter :sentinel #'irc--sentinel
             :plist '(:host "irc.local" :service 6667) :keepalive t))
 
-  (it "should call `make-tls-process' if tls was requested"
+  (it "should call `make-network-process' if tls was requested"
     (irc-connect :host "irc.local"
                  :service 6667
                  :tls t)
 
-    (expect 'make-tls-process
-            :to-have-been-called))
+    (expect 'make-network-process
+            :to-have-been-called-with
+            :name "irc.local" :host "irc.local" :service 6667
+            :family nil
+            :coding 'no-conversion :nowait t :noquery t
+            :tls-parameters default-tls-parameters
+            :filter #'irc--filter :sentinel #'irc--sentinel
+            :plist '(:host "irc.local" :service 6667 :tls t) :keepalive t))
 
   (it "should return a process when using non-tls connections"
     (expect (irc-connect :host "irc.local"
@@ -43,7 +56,7 @@
     (expect (irc-connect :host "irc.local"
                          :service 6667
                          :tls t)
-            :to-be 'the-test-tls-process))
+            :to-be 'the-test-process))
 
   (it "should not use nowait if it is not supported"
     (spy-on 'featurep :and-return-value nil)
@@ -60,6 +73,7 @@
             :name "irc.local" :host "irc.local" :service 6667
             :family nil
             :coding 'no-conversion :nowait nil :noquery t
+            :tls-parameters nil
             :filter #'irc--filter :sentinel #'irc--sentinel
             :plist '(:host "irc.local" :service 6667) :keepalive t))